ShinyHunters Data-Theft and Extortion Targeting CarGurus and Wynn Resorts

ShinyHunters is linked to multiple large-scale data-theft and extortion operations, including a breach at automotive marketplace CarGurus in February 2026. After an attempted extortion, the stolen CarGurus data was published publicly and reportedly included 12M+ email addresses across multiple files, with additional exposed information such as names, phone numbers, physical and IP addresses, user account ID mappings, dealer account/subscription details, and auto finance pre-qualification application data (including application outcomes).

ShinyHunters also claimed to have stolen 800,000+ records from Wynn Resorts and demanded 22.34 Bitcoin (~$1.5M) to prevent publication, setting a deadline and threatening further “digital problems” if unpaid. Data samples reviewed by a media outlet reportedly contained employee PII including Social Security numbers, names, emails, phone numbers, job details, salaries, start dates, and birthdays; the group alleged initial access occurred in September 2025 via an Oracle PeopleSoft vulnerability combined with an employee’s credentials, and it did not clarify whether the credentials were obtained through social engineering or insider access-for-hire.